DOCSLIB.ORG

Optimization of Time Synchronization Techniques on Computer Networks Faten Mkacher

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Optimization of Time Synchronization Techniques on Computer Networks Faten Mkacher Optimization of Time Synchronization Techniques on Computer Networks Faten Mkacher To cite this version: Faten Mkacher. Optimization of Time Synchronization Techniques on Computer Networks. Operating Systems [cs.OS]. Université Grenoble Alpes [2020-..], 2020. English. NNT : 2020GRALM015. tel- 02988168 HAL Id: tel-02988168 https://tel.archives-ouvertes.fr/tel-02988168 Submitted on 4 Nov 2020 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. THÈSE Pour obtenir le grade de DOCTEUR DE L’UNIVERSITÉ GRENOBLE ALPES Spécialité : Informatique Arrêté ministériel : 25 mai 2016 Présentée par Faten MKACHER Thèse dirigée par Andrzej DUDA et coencadrée par Fabrice GUERY Préparée au sein du Laboratoire d’Informatique de Grenoble (LIG), dans l’École Doctorale Mathématiques, Sciences et Technologies de l’Information, Informatique (EDMSTII). Optimization of Time Synchronization Techniques on Computer Networks Thèse soutenue publiquement le 02 juin 2020, devant le jury composé de : Noel de Palma Professeur, Université Grenoble Alpes, Président Katia Jaffrés-Runser Maître de conférence, Université de Toulouse, Rapporteur Hervé Rivano Professeur, Université INSA de Lyon, Rapporteur Andrzej Duda Professeur, Grenoble INP, Directeur de thèse Fabrice Guery Responsable Innovation, Gorgy Timing, Invité 2 Abstract Nowadays, as society has become more interconnected, secure and accurate time-keeping be- comes more and more critical for many applications. Computing devices usually use crystal clocks with low precision for local synchronization. These low-quality clocks cause a large drift between machines. The solution to provide precise time synchronization between them is to use a refer- ence clock having an accurate source of time and then disseminate time over a communication network to other devices. One of the protocols that provide time synchronization over packet- switched networks is Network Time Protocol (NTP). Although NTP has operated well for a general- purpose use for many years, both its security and accuracy are ill-suited for future challenges. Many security mechanisms rely on time as part of their operation. For example, before using a digital certificate, it is necessary to confirm its time validity. A machine with an inaccurate clock can accept an expired or revoked certificate. This thesis first provides a background on time synchronization starting with the definition of some fundamental concepts such as the clock model, the problem of clock synchronization, and some notions like accuracy, precision, and stability of clocks. We study the most common time synchronization protocols used in packet-switched networks, and among others NTP. Then, we consider the security of time synchronization by presenting the possible security threats against time synchronization protocols and the security requirements of these protocols. We zoom in on the security of the NTP protocol as described by the standard NTP and other related work that tried to enhance NTP security. We also discuss the importance of having a well-balanced trade-off between security and performance. In our first contribution, we propose to go further in the support of NTP security with Secure Time Synchronization protocol (STS), a new secure authenticated time synchronization protocol suitable for widespread deployments. We describe the operation of STS and prove its design secure with a formal analysis using two security protocol verification tools: Proverif and Tamarin. We present the implementation of STS based on the OpenNTPd project, and evaluate its performance by comparing the STS precision with unauthenticated NTP. We point out the circular dependency between certificate validation and time synchroniza- tion. In fact, reliable time synchronization requires cryptographic materials that are valid only over designated time intervals, but time intervals can be only enforced when participating hosts are reliably synchronized. We present a solution for bootstrapping time synchronization based on the Bitcoin blockchain to break this circular dependency. In our second contribution, we propose a method for improving the accuracy of the NTP pro- tocol by taking into account asymmetric transmission delays due to different bandwidth or routing on the forward and backward paths. In fact, asymmetry is quite prevalent in the Internet, which leads to low accuracy of NTP that relies on the symmetric delay assumption to compute the clock offset. This method builds on using an NTP client synchronized with GPS to measure precisely the one-way transmission delay on the forward and backward path with his time server. In this way, it is possible to calibrate NTP to take into account asymmetry. Keywords time synchronization, Network Time Protocol (NTP), security, accuracy, One-Way-Delay (OWD). 4 Résumé De nos jours, alors que la société est toujours plus interconnectée, une synchronisation tempo- relle sûre et précise devient de plus en plus critique pour de nombreuses applications. Les dispo- sitifs informatiques utilisent souvent des oscillateurs à cristal de faible précision pour conserver le temps en local. Cette imprécision engendre une dérive entre les machines. La solution pour assurer une synchronisation précise de l’heure entre elles est d’utiliser une horloge de référence avec une source précise de temps, puis de diffuser le temps sur le réseau. Un des protocoles qui assurent la synchronisation temporelle est Network Time Protocol (NTP). Bien que NTP ait bien fonctionné pour un usage général pendant de nombreuses années, sa sécurité et sa précision sont mal adaptées aux défis futurs. De nombreux mécanismes de sécurité dépendent du temps dans le cadre de leur fonctionnement. Par exemple, avant d’utiliser un certificat électronique, il est né- cessaire de confirmer sa validité temporelle. Une machine avec une horloge imprécise pourrait accepter des certificats expirés ou révoqués. Cette thèse présente d’abord le contexte de la synchronisation temporelle en commençant par la définition de certains concepts fondamentaux tels que le modèle d’horloge, le problème de la synchronisation d’horloge et certaines notions comme l’exactitude, la précision et la stabilité des horloges. Nous étudions les protocoles de synchronisation temporelle les plus courants des réseaux de communication, et entre autres NTP. Ensuite, nous considérons la sécurité de la synchronisation temporelle en présentant les pos- sibles menaces de sécurité contre les protocoles de synchronisation temporelle et les exigences de sécurité de ces protocoles. Nous nous concentrons sur la sécurité du protocole NTP tel que décrit par le standard, et les travaux connexes qui ont tenté de l’améliorer sur ce point. Nous discutons également de l’importance d’avoir un compromis bien équilibré entre sécurité et performance. Dans notre première contribution, nous proposons d’aller plus loin que NTP avec Secure Time Synchronization Protocol (STS), un nouveau protocole de synchronisation de l’heure, qui est au- thentifié et sécurisé, et adapté aux larges déploiements. Nous décrivons le fonctionnement de STS et prouvons sa conception sécurisée, à l’aide d’une analyse formelle faite par deux outils de véri- fication de protocole de sécurité : Proverif et Tamarin. Nous présentons l’implémentation de STS basée sur le projet OpenNTPd, et évaluons ses performances en comparant la précision de STS avec celle de NTP non authentifié. Nous soulignons la dépendance circulaire entre la validation du certificat et la synchronisation temporelle. En réalité, une synchronisation temporelle fiable nécessite des matériaux cryptogra- phiques qui ne sont valables que sur des intervalles de temps désignés, mais ces intervalles de temps ne peuvent être comparés à l’heure actuelle que lorsque les hôtes participants sont syn- chronisés de manière fiable. Nous présentons une solution qui fournit, lors de l’amorçage, une synchronisation approximative basée sur le blockchain Bitcoin, pour rompre cette dépendance circulaire. Dans notre deuxième contribution, nous proposons une méthode pour améliorer l’exactitude du protocole NTP, en tenant compte des délais de transmission asymétriques dus à une bande passante ou à un routage différent sur le chemin d’aller et de retour. En fait, l’asymétrie est as- sez répandue sur Internet, ce qui dégrade la performance de NTP qui fait l’hypothèse de délais symétriques. Cette méthode s’appuie sur l’utilisation d’un client NTP synchronisé par GPS, pour mesurer le délai unidirectionnel minimal aller et retour jusqu’à son serveur de temps. Ainsi, il est possible de calibrer NTP en prenant en compte cette asymétrie. Mots-clefs synchronisation temporelle, Network Time Protocol (NTP), sécurité, exactitude, précision, délai unidirectionel. 5 6 Contents Contents 7 List of Figures 9 List of Tables 11 List of Acronyms 13 Foreword 15 Introduction 17 I Time Synchronization: State of the Art 25 1 Time Synchronization Concept 27 1.1 Fundamental Concepts of Time Synchronization..................... 28 1.1.1 Time and Clocks.................................... 28 1.1.2 Clocks
Load more

Recommended publications
  • Qos: NBAR Protocol Library, Cisco IOS XE Release 3.8S
    QoS: NBAR Protocol Library, Cisco IOS XE Release 3.8S Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 C O N T E N T S 3COM-AMP3 through AYIYA-IPV6-TUNNELED 34 3COM-AMP3 35 3COM-TSMUX 36 3PC 37 9PFS 38 914C G 39 ACAP 40 ACAS 40 ACCESSBUILDER 41 ACCESSNETWORK 42 ACP 43 ACR-NEMA 44 ACTIVE-DIRECTORY 45 ACTIVESYNC 45 ADOBE-CONNECT 46 AED-512 47 AFPOVERTCP 48 AGENTX 49 ALPES 50 AMINET 50 AN 51 ANET 52 ANSANOTIFY 53 ANSATRADER 54 ANY-HOST-INTERNAL 54 AODV 55 AOL-MESSENGER 56 AOL-MESSENGER-AUDIO 57 AOL-MESSENGER-FT 58 QoS: NBAR Protocol Library, Cisco IOS XE Release 3.8S ii Contents AOL-MESSENGER-VIDEO 58 AOL-PROTOCOL 59 APC-POWERCHUTE 60 APERTUS-LDP 61 APPLEJUICE 62 APPLEQTC 63 APPLEQTCSRVR 63 APPLIX 64 ARCISDMS 65 ARGUS 66 ARIEL1 67 ARIEL2 67 ARIEL3 68 ARIS 69 ARNS 70 ARUBA-PAPI 71 ASA 71 ASA-APPL-PROTO 72 ASIPREGISTRY 73 ASIP-WEBADMIN 74 AS-SERVERMAP 75 AT-3 76 AT-5 76 AT-7 77 AT-8 78 AT-ECHO 79 AT-NBP 80 AT-RTMP 80 AT-ZIS 81 AUDIO-OVER-HTTP 82 AUDIT 83 AUDITD 84 AURORA-CMGR 85 AURP 85 AUTH 86 QoS: NBAR Protocol Library, Cisco IOS XE Release 3.8S iii Contents AVIAN 87 AVOCENT 88 AX25 89 AYIYA-IPV6-TUNNELED 89 BABELGUM through BR-SAT-MON 92 BABELGUM 93 BACNET 93 BAIDU-MOVIE 94 BANYAN-RPC 95 BANYAN-VIP 96 BB 97 BBNRCCMON 98 BDP 98 BFTP 99 BGMP 100 BGP 101 BGS-NSI 102 BHEVENT 103 BHFHS 103 BHMDS 104 BINARY-OVER-HTTP 105 BITTORRENT 106 BL-IDM 107 BLIZWOW 107 BLOGGER 108 BMPP 109 BNA 110 BNET 111 BORLAND-DSJ 112 BR-SAT-MON 112
    [Show full text]
  • INTERNET-DRAFT M. Ackermann Intended Status: Informational BCBS Michigan N
    INTERNET-DRAFT M. Ackermann Intended Status: Informational BCBS Michigan N. Elkins W. Jouris Inside Products Expires: April 2014 October 3, 2013 Usage of NTP for the PDM DOH IPv6 Extension Header draft-ackermann-tictoc-pdm-ntp-usage-00 Abstract The Performance and Diagnostic Metrics (PDM) Destination Options Header (DOH) for IPv6 defines metrics which are critical for timely end-to-end problem resolution, without impacting an operational production network. These metrics and their derivations can be used for network diagnostics. The base metrics are: packet sequence number and packet timestamp. The timestamp fields require time synchronization at the two end points. This document provides implementation guidelines for implementing Network Time Protocol (NTP) to provide such synchronization. Status of this Memo This Internet-Draft is submitted to IETF in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/1id-abstracts.html The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html Ackermann Expires April, 2014 [Page 1] INTERNET DRAFT -ackermann-tictoc-pdm-ntp-usage-00 October 2013 Copyright and License Notice Copyright (c) 2013 IETF Trust and the persons identified as the document authors.
    [Show full text]
  • A Framework for Designing Cryptographic Key Management Systems
    NIST Special Publication 800-130 A Framework for Designing Cryptographic Key Management Systems Elaine Barker Miles Smid Dennis Branstad Santosh Chokhani C O M P U T E R S E C U R I T Y NIST Special Publication 800-130 A Framework for Designing Cryptographic Key Management Systems Elaine Barker Computer Security Division Information Technology Laboratory Miles Smid Orion Security Solutions Silver, Spring, MD Dennis Branstad NIST Consultant Austin, TX Santosh Chokhani Cygnacom McLean, VA August 2013 U.S. Department of Commerce Penny Pritzker, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Under Secretary of Commerce for Standards and Technology and Director SP 800-130 August 2013 Authority This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Management Act (FISMA), Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in Circular A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority.
    [Show full text]
  • Introduction to Public Key Infrastructures
    Introduction to Public Key Infrastructures Johannes A. Buchmann • Evangelos Karatsiolis Alexander Wiesmaier Introduction to Public Key Infrastructures 123 Johannes A. Buchmann Evangelos Karatsiolis FB Informatik FlexSecure GmbH TU Darmstadt Darmstadt Darmstadt Germany Germany Alexander Wiesmaier AGT International Darmstadt Germany ISBN 978-3-642-40656-0 ISBN 978-3-642-40657-7 (eBook) DOI 10.1007/978-3-642-40657-7 Springer Heidelberg New York Dordrecht London Library of Congress Control Number: 2013954524 © Springer-Verlag Berlin Heidelberg 2013 This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. Exempted from this legal reservation are brief excerpts in connection with reviews or scholarly analysis or material supplied specifically for the purpose of being entered and executed on a computer system, for exclusive use by the purchaser of the work. Duplication of this publication or parts thereof is permitted only under the provisions of the Copyright Law of the Publisher’s location, in its current version, and permission for use must always be obtained from Springer. Permissions for use may be obtained through RightsLink at the Copyright Clearance Center. Violations are liable to prosecution under the respective Copyright Law. The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.
    [Show full text]
  • Time-Stamp Policy and Time-Stamp Practice Statement
    Time-Stamp Policy and Time-Stamp Practise Statement Version 1.1 11 January 2019 MSC Trustgate.com Sdn. Bhd.(478231-X) Suite 2-9, Level 2 Block 4801 CBD Perdana, Jalan Perdana, 63000 Cyberjaya Selangor Darul Ehsan, Malaysia Tel: +603 8318 1800 www.msctrustgate.com [email protected] TrustgateTime-Stamp Policy and Practise Statement ©2018 MSC Trustgate.com Sdn Bhd (478231-X). All rights reserved. Revision date: 11 January 2019 Trademark Notices 9 MSC Trustgate and its associated logos are the registered trademarks of MSC Trustgate.com Sdn Bhd or its affiliates. Other names may be trademarks of their respective owners. Without limiting the rights reserved above, and except as licensed below, no part of this publication may be reproduced, stored in or introduced into a retrieval system, or transmitted, in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), without prior written permission of MSC Trustgate. Notwithstanding the above, permission is granted to reproduce and distribute this MSC Trustgate Time- Stamp Policy and Time-Stamp Practise Statement on a nonexclusive, royalty-free basis, provided that (i) the foregoing copyright notice and the beginning paragraphs are prominently displayed at the beginning of each copy, and (ii) this document is accurately reproduced in full, complete with attribution of the document to MSC Trustgate. Requests for any other permission to reproduce this MSC Trustgate Time-Stamp Policy and Time-Stamp Practise Statement must be addressed to MSC Trustgate.com Sdn Bhd, Suite 2-9, Level 2, Block 4801 CBD Perdana, Jalan Perdana, 63000 Cyberjaya, Selangor Darul Ehsan, Malaysia or via email at [email protected].
    [Show full text]
  • The Delivery and Evidences Layer
    The Delivery and Evidences Layer Amir Herzberg and Igal Yoffe Computer Science Department, Bar Ilan University, Ramat Gan, 52900, Israel {herzbea,ioffei}@cs.biu.ac.il April 4, 2007 Abstract. Evidences of delivery are essential for resolving (and avoiding) disputes on delivery of messages, in classical as well as electronic commerce. We present the first rigorous specifications and provably-secure implementation, for a communication layer providing time-stamped evidences for the message delivery process. This improves on existing standards for evidences (‘non-repudiation’) services, based on informal specifications and unproven designs. Our work also improves on the large body of analytical works on tasks related to evidences of delivery, such as certified mail/delivery protocols and fair exchange (of signatures). We improve by address- ing practical needs and scenarios, using realistic synchronization and communication assumptions, supporting time-outs and failures, and providing well-defined interface to the higher-layer protocols (application). Furthermore, we use the layered specifications framework, allowing provably-secure use of our protocol, with lower and higher layer protocols, with complete re-use of our analysis (theorems). Keywords: Certified delivery, cryptographic protocol, fair exchange, layered specifications, non-repudiation, secure e-commerce. 1 Introduction Reliable, fair and time-stamped message delivery is central to development of e-commerce. Without a doubt, every business relationship between parties includes provisions, whether implicit or explicit, regarding resolution of disputes and the communication mechanism between the trading parties. In addition, when commercial risk is substantial, typically a notarial entity is introduced for the certification and time-stamping of mail. Currently deployed messaging systems typically do not have a secure, agreed mechanism for fair resolution of disputes regarding communicated messages.
    [Show full text]
  • Arxiv:1804.00875V1 [Cs.CR] 3 Apr 2018 and Works with the Legacy TLS Ecosystem
    Blockchain-based TLS Notary Service Pawel Szalachowski SUTD [email protected] Abstract on the trust on first use model [6], moreover, it is a one- time operation (i.e., per certificate issuance). Therefore, The Transport Layer Security (TLS) protocol is a de an adversary able to impersonate a domain, even for just facto standard of secure client-server communication on a moment, can obtain a valid certificate for this domain. the Internet. Its security can be diminished by a vari- Besides that, the TLS PKI is a weakest-link system, and ety of attacks that leverage on weaknesses in its design compromising a single CA (out of hundreds of trusted and implementations. An example of a major weakness CAs [35]) can result in a successful impersonation at- is the public-key infrastructure (PKI) that TLS deploys, tack, as observed in the past [1, 11]. which is a weakest-link system and introduces hundreds of links (i.e., trusted entities). Consequently, an adver- One of the first approaches to mitigate such attacks sary compromising a single trusted entity can imperson- were notary systems [26,45]. The main idea behind them ate any website. is to introduce the new trusted party, known as a notary. The notary provides a TLS client with its view of the Notary systems, based on multi-path probing, were contacted server’s public key. Hence, the client gets bet- early and promising proposals to detect and prevent such ter guarantees that the key is legitimate. Notary systems attacks. Unfortunately, despite their benefits, they are are based on multi-path probing and assume that attacks not widely deployed, mainly due to their long-standing are usually short-lived or/and scoped to a network topol- unresolved problems.
    [Show full text]
  • TCP+UDP Ports
    TCP+UDP Ports Port Transport Description Port Transport Description Shirt Pocket netTunes; Shirt Pocket 47 TCP, UDP NI FTP 0 TCP launchTunes 48 TCP, UDP Digital Audit Daemon 1 TCP TCP Port Service Multiplexer (TCPMUX) 49 TCP, UDP TACACS+; TACACS 2 TCP, UDP Management Utility 50 UDP Remote Mail Checking Protocol (RMCP) 3 TCP, UDP Compression Process 51 TCP, UDP Logical Address Maintenance (IMP) Self-Certifying File System (SFS); Midnight 52 TCP, UDP XNS Time Protocol 4 Commander 53 TCP, UDP Domain Name System (DNS) 5 TCP, UDP Remote Job Entry 54 TCP, UDP XNS Clearinghouse 6 55 TCP, UDP ISI Graphics Language 7 TCP, UDP Echo 56 TCP, UDP XNS Authentication 8 57 TCP Mail Transfer Protocol (MTP) 9 SCTP, TCP, UDP Discard 58 TCP, UDP XNS Mail 10 59 TCP NFILE 11 TCP, UDP SYSTAT 60 12 61 TCP, UDP NI MAIL 13 TCP, UDP Daytime 62 TCP, UDP ACA Services 14 63 TCP, UDP Whois++ 15 Netstat 64 TCP, UDP CI, Communications Integrator 16 65 TCP, UDP TACACS-Database Service 17 TCP, UDP Quote of the Day 66 TCP, UDP Oracle SQL*NET Remote Write Protocol (RWP); Message 67 UDP Bootstrap Protocol server (BOOTP) 18 TCP, UDP Send Protocol 68 UDP Bootstrap Protocol client (BOOTP) 19 TCP, UDP Character Generator Protocol (Chargen) 69 UDP Trivial File Transfer Protocol (TFTP) 20 TCP File Transfer Protocol (FTP) 70 TCP Gopher 21 TCP File Transfer Protocol (FTP) 71 TCP, UDP Remote Job Service 22 SCTP, TCP Secure Shell (SSH) 72 TCP, UDP Remote Job Service 23 TCP Telnet 73 TCP, UDP Remote Job Service 24 Any private mail system 74 TCP, UDP Remote Job Service 25 TCP Simple
    [Show full text]
  • ETG Template
    WELCOME!!!!! 11.05.2011 The Ethernet Fieldbus Joey Stubbs, PE, PMP North American Representative EtherCAT Technology Group 11.05.2011 Ethernet Overview: CSMA/CD, TCP/IP & others • Architecture • Physical Layer: Signal, Cables + Wiring • Media Access Control • Name Resolution • Routing • IP, TCP + UDP This diagram was hand drawn by Robert M. Metcalfe and photographed by Dave R. Boggs in 1976 to produce a 35mm slide used to present Ethernet to the National Computer Conference in June of that year. 11.05.2011 ETG EtherCAT Training Class Ethernet Definition (Wikipedia) • Ethernet is a frame-based computer networking technology for local area networks (LANs). • It defines wiring and signaling for the physical layer, and frame formats and protocols for the media access control (MAC)/data link layer of the OSI model. • Ethernet is mostly standardized as IEEE's 802.3. • It has become the most widespread LAN technology in use during the 1990s to the present, and has largely replaced all other LAN standards such as token ring, FDDI, and ARCNET. 11.05.2011 ETG EtherCAT Training Class ISO/OSI, IEEE 802 and TCP/IP ISO/OSI - Model TCP/IP - Model 7 Application Layer 5 Application Layer: contains a variety of commonly used protocols, such as file HTTP, FTP, rlogin, Telnet, DHCP,... transfer, virtual terminal, and email 6 Presentation Layer manages the syntax and semantics of the information transmitted between two computers 5 Session Layer establishes and manages sessions, conversions, or dialogues between two computers 4 Transport Layer 4 Transport Layer: TCP + UDP splits data from the session layer into smaller packets for Handles communication among programs on a network.
    [Show full text]
  • Non-Repudiation in Internet Telephony
    Non-Repudiation in Internet Telephony Nicolai Kuntze1, Andreas U. Schmidt1, and Christian Hett2 1 Fraunhofer–Institute for Secure Information Technology SIT Rheinstraße 75, 64295 Darmstadt, Germany {andreas.u.schmidt,nicolai.kuntze}@sit.fraunhofer.de 2 ARTEC Computer GmbH Robert-Bosch Straße 38, 61184 Karben, Germany [email protected] Abstract. We present a concept to achieve non-repudiation for natural language conversations over the Internet. The method rests on chained electronic signatures applied to pieces of packet-based, digital, voice communication. It establishes the integrity and authenticity of the bidi- rectional data stream and its temporal sequence and thus the security context of a conversation. The concept is close to the protocols for Voice over the Internet (VoIP), provides a high level of inherent security, and extends naturally to multilateral non-repudiation, e.g., for conferences. Signatures over conversations can become true declarations of will in analogy to electronically signed, digital documents. This enables bind- ing verbal contracts, in principle between unacquainted speakers, and in particular without witnesses. A reference implementation of a secure VoIP archive is exists. 1 Introduction The latest successful example for the ever ongoing convergence of information technologies is Internet based telephony, transporting voice over the Internet protocol (VoIP). Analysts estimate a rate of growth in a range of 20% to 45% an- nually, expecting that VoIP will carry more than fifty percent of business voice traffic (UK) in a few years [1]. The success of VoIP will not be limited to cable networks, convergent speech and data transmission will affect next generation mobile networks as well.
    [Show full text]
  • Certificate Practice Statement for Entrust SSL Certificates
    ENTRUST CERTIFICATE SERVICES Certification Practice Statement Version: 3.8 December 31, 2020 © 2020 Entrust Limited. All rights reserved. Revision History Issue Date Changes in this Revision 1.0 May 26, 1999 Initial version. 2.0 July 1, 2000 Addition of provisions dealing with subordinate entities (such as third party registration authorities) in the Entrust.net SSL Web Server public key infrastructure. Revision of numerous other terms and conditions. 2.01 May 30, 2001 Minor revisions having no substantive impact. 2.02 January 1, 2002 Minor revisions related to replacement Cross Certificate. 2.03 January 1, 2003 Entrust legal name change. 2.04 August 20, 2003 Minor revisions related to use of certificates on more than one server; permitting use of asterisk in Subject name 2.05 November 28, 2003 Minor revisions to language to handle licensing issues. 2.06 May 14, 2004 Minor revisions to language for export requirements. 2.1 August 1, 2007 Minor revisions to ensure consistency with the CPS for EV SSL Certificates and to add OCSP references. 2.2 August 11, 2008 Minor revisions to terminology to replace references to Entrust SSL Web Server Certificates with Entrust SSL Certificates. Revision to authentication of individuals, routine rekey and key changeover. Other minor revisions having no substantive impact. 2.3 September 8, 2009 Updates for Code Signing and Client Certificates. Added Appendix A with Certificate Profiles. Revisions to add additional application software vendors and relying parties as third party beneficiaries. Deleted Subscriber
    [Show full text]
  • NTP Working Group D. Sibold Internet-Draft PTB Intended Status: Standards Track S
    NTP Working Group D. Sibold Internet-Draft PTB Intended status: Standards Track S. Roettger Expires: January 5, 2015 K. Teichel PTB July 04, 2014 Network Time Security draft-ietf-ntp-network-time-security-04.txt Abstract This document describes the Network Time Security (NTS) protocol that enables secure authentication of time servers using Network Time Protocol (NTP) or Precision Time Protocol (PTP). Its design considers the special requirements of precise timekeeping, which are described in Security Requirements of Time Protocols in Packet Switched Networks [I-D.ietf-tictoc-security-requirements]. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on January 5, 2015. Sibold, et al. Expires January 5, 2015 [Page 1] Internet-Draft NTS July 2014 Copyright Notice Copyright (c) 2014 IETF Trust and the persons identified as the document authors.
    [Show full text]